View source for CJEU - C-740/22 - Endemol Shine Finland

{{CJEUdecisionBOX

|Case_Number_Name=C-740/22 Endemol Shine Finland
|ECLI=ECLI:EU:C:2024:216

|Opinion_Link=
|Judgement_Link=ttps://curia.europa.eu/juris/document/document.jsf?docid=283530&doclang=en

|Date_Decided=07.03.2024
|Year=2024

|GDPR_Article_1=Article 2(1) GDPR
|GDPR_Article_Link_1=Article 2 GDPR#1
|GDPR_Article_2=Article 4(2) GDPR
|GDPR_Article_Link_2=Article 4 GDPR#2
|GDPR_Article_3=Article 4(6) GDPR
|GDPR_Article_Link_3=Article 4 GDPR#6
|GDPR_Article_4=Article 5(1)(a) GDPR
|GDPR_Article_Link_4=Article 5 GDPR#1a
|GDPR_Article_5=Article 6(1)(e) GDPR
|GDPR_Article_Link_5=Article 6 GDPR#1e
|GDPR_Article_6=Article 10 GDPR
|GDPR_Article_Link_6=Article 10 GDPR
|GDPR_Article_7=
|GDPR_Article_Link_7=
|GDPR_Article_8=
|GDPR_Article_Link_8=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Reference_Body=Administrative Court of Eastern Finland
|Reference_Case_Number_Name=

|Initial_Contributor=nzm
|
}}

The CJEU held that data relating to criminal convictions contained in a court’s filing system cannot be disclosed for the purpose of ensuring public access to documents if the person requesting the disclosure does not establish that they have a “specific interest” in obtaining said data.

==English Summary==

=== Facts ===
A data subject participated in a competition organized by Endemol Shine Finland. The latter made an oral request to the Etelä-Savon käräjäoikeus (District Court, South Savo, Finland) for information on possible ongoing or completed criminal proceedings concerning the data subject, for the purpose of clarifying their criminal record. The district court refused the request. 

Following this, Endemol Shine Finland brought an appeal against the judgement before the Itä-Suomen hovioikeus (Court of Appeal, Eastern Finland, Finland). The latter stayed the proceedings and referred three questions to the CJEU:

# Does an oral transfer of personal data constitute processing of personal data within the meaning of [[Article 2 GDPR#1|Article 2(1)]] and [[Article 4 GDPR#2|4(2) GDPR]]
# Can public access to official documents allow information on criminal convictions or offences to be obtained from a court’s register without restriction when the request is made orally?
# Is it relevant whether the person requesting the information is a company or a private individual?

=== Holding ===
'''On the first question:'''   

[[Article 4 GDPR#2|Article 4(2) GDPR]] defines “processing” as: any operation or set of operations which is performed on the personal data or on sets of personal data, whether or not by automated means. 

The Court determined that the use of “any operation” in this definition is intended to give the concept of “processing” a broad scope, which is corroborated by the non-exhaustive nature, expressed by the phrase “such as”. The Court added that [[Article 4 GDPR#2|Article 4(2) GDPR]] does not lay down any condition as to the form of processing meaning that the concept of processing covers the oral disclosure of personal data. 

The question still arose as to whether the oral disclosure of personal data falls within the material scope of the GDPR. [[Article 2 GDPR#1|Article 2(1) GDPR]] provides that the GDPR applies to the processing wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. [[Article 4 GDPR#6|Article 4(6) GDPR]] defines a “filing system” as: any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis. 

The oral disclosure of personal data constitutes processing other than by automated means. Therefore, the Court indicated that the data of that processing must form part or be intended to form part of a filing system in order for that processing to come within the material scope of the GDPR. In the present case, the Court held that it was clear that the data requested by Endemol Shine Finland Oy were contained in a “court’s register of persons” which constituted a filing system within the meaning of [[Article 4 GDPR#6|Article 4(6) GDPR]].  

'''On the second and third questions:'''

The Court pointed out that any processing of personal data must (i) comply with the principles relating to the processing of personal data and (ii) in order to comply with principle of lawfulness laid down in [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]], satisfy one of the conditions listed in [[Article 6 GDPR]] (see [https://gdprhub.eu/index.php?title=CJEU_-_C-439/19_-_B_v._Latvijas_Republikas_Saeima C-439/19] and [https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%91634/21_-_SCHUFA C-634/21]). The Court found that the oral disclosure of the public data relating to criminal convictions may fall within [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], under which processing is lawful if and to the extent that it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

[[Article 10 GDPR]] makes the processing of data relating to criminal convictions and offences subject to additional restrictions: under said provision, the processing of such data shall be carried out only under the control of an official authority, unless it is authorized by Union or Member State law providing the appropriate safeguards for the rights and freedoms of data subjects’.

The Court considered that the GDPR does not preclude personal data being disclosed to the public if the disclosure is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, within the meaning of [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], even where the data related to criminal convictions and offences.

In order to determine (i) whether public disclosure of personal data relating to criminal convictions is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, within the meaning of [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]] and (ii) whether the legislation authorising such disclosure provides for appropriate safeguards for the rights and freedoms of data subjects, the Court indicated that the judge must take into account the seriousness of the interference with the fundamental right to respect for private life and to the protection of personal data caused by that disclosure.

Regarding the seriousness of the interference with those rights, due to the sensitivity of data relating to criminal convictions and offences, the processing of such data may constitute a particularly serious interference with the fundamental rights to respect private life and to the protection of personal data. The Court adds that this data relates to behaviour that gives rise to social disapproval and is liable to stigmatise the data subject (see [https://gdprhub.eu/index.php?title=CJEU_-_C-439/19_-_B_v._Latvijas_Republikas_Saeima C-439/19]).

The Court found that in the light of the sensitivity of data relating to relating to criminal convictions and of the seriousness of the interference with the fundamental rights of data subjects to respect for private life and to the protection of personal data, which is caused by the disclosure of such data, those rights prevail over the public’s interest in having access to official documents. For the same reason, the right to freedom of information under [[Article 85 GDPR|Article 85 GDPR]] cannot justify the disclosure to any person who requests personal data relating to criminal convictions. 

Therefore, the Court held that [[Article 6 GDPR#1e|Article 6(1)(e)]] and [[Article 10 GDPR|Article 10 GDPR]] preclude data relating to criminal convictions contained in a court’s filing system from being disclosed orally to any person for the purpose of ensuring public access to official documents if the person requesting the disclosure does not establish that they have a specific interest in obtaining said data. The Court added that it is irrelevant whether that person is a commercial company or a private individual.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''